Rails 4 Quick Look: Strong Parameters

Rails always comes up with some and creative new features, and Rails 4 is no exception. One of the new features in Rails 4 is Strong Parameters.
The basic idea behind Strong Parameters is to move mass-assignment protection out of the model and into the controller where it belongs.

Just so we’re all on the same page, let’s talk about Mass-Assignment before focusing on strong parameters.

Mass-Assignment: Assigning attributes of a model in a hash

Let’s take an simple example.

Assume we have a User model with name, email, and admin. Admin is a boolean attribute used to indicate if the user has administrative rights.

The Rails way of creating a user looks like:

and updating:

This is often done by sending parameters through a form and creating/updating the object in controller. This way we don’t need to set value of each attribute.

Problem with Mass-Assignment: Security vulnerability

Mass-assignment saves us the need to assign values to each attribute of the model, but it can create problems. Since we aren’t restricting which attributes can be set nor are we checking the valus of these attributes, a malicious hacker could assign any value to any attribute. In our example, he could set the value of admin true, making himself a super user.

Here is what the url might look like

http://www.example.com/user/signup?user[name]=ow3ned&user[admin]=1

or through form using browser console

After clicking on the button you will see

This way the user can exploit the security vulnerability.

As you might guess, this is bad, and it gets worse. This is not limited to only one model, if we have model relationships like has_many,has_one or has_many :through

When an account record is created, rooms can also be created through mass-assignment(params[:account]). In other words, referenced tables can also become target of attackers

There is a live example of this kind of security vulnerability that happened on Github. Because of mass-assignment, a user passed his ssh-key through the public key update form to add himself into the Rails repository and created a commit.

To explore it more lets write some code.
Say we have a book_store app, with a model called Book. The Book model has name, author and public(boolean) attributes. We have user authentication based on role (admin,user).

Mass-Assignment Protection at Model Level

In the Book model :

Every user can create and update book and make them public from User Interface.

If we want to restrict users that are not admins from updating the public attribute, then we need to do something like:

In BooksController we need to do like :

Now only admin can update public field through form. Now, we add a new role called reporting_user who can only update name.

We have to add some more conditions in controller also like

As you can see we all are handling user access control on the basis of user role that’s related more to controller instead of model. We know the controller handles the flow between user and application, authentication and authorization, which is why mass-assignment protection should be handled in the controller instead of model.

Let’s look at Strong Parameters now, first in Rails 3.

Mass-Assignment Protection at Controller Level: Strong Parameter Gem

In Rails 3.2.7 attributes are whitelisted by default, so first we need to remove (or set it to ‘false’) the following code in config/application.rb

Next add add the gem in Gemfile

and run bundle to activate strong_parameters.

Add the following line to the Book model:

This will raise an ActiveModel::ForbiddenAttributes exception because it’s using mass assignment

Now in our controller we handle mass-assignment calling a permit :

Also, you can specialize this private method with per-user checking of permissible attributes: params[:book].permit(:name,:author,:public)

You can do :

If a user other than admin attempts to add/update the public field value, it won’t raise any error but justignore this update.

According to the docs, it supports nested attributes. For example, if a book has many chapters, then in the controller we can call permit like:

Strong Parameters will be part of Rails 4.
If you make a sample app with Rails 4 and generate a scaffold user with name and email attributes, it will generate a user_params private method :

There is lots of discussion going on around this issue. You can check the commits here

Wrap Up

I think we’ve just about covered most things about mass-assignment and strong parameters.

With Strong Parameters :

You can keep your model code clean

You can handle authorization and access of parameters in the controller where it belongs

If you want to learn more about mass-assignment and strong_parameters:

And if you enjoyed reading this post, you’ll love Learnable; the place to learn fresh skills and techniques from the masters. Members get instant access to all of SitePoint’s ebooks and interactive online courses, like Jump Start Rails.

Comments on this article are closed. Have a question about Ruby on Rails? Why not ask it on our forums?

Strong parameters gem have very poor documentation and wiki is empty. Your post is far more descriptive. Thanks!

Satty Bhens

Great article. Helps a ton!

Sean

This’s a great article!!
Thanks for your effort!!

Alan Brown

Clear, concise and complete. Thanks!

Jayawanth

Nice write up. I am unable to follow towards the end where you introduce require method

http://www.marnen.org Marnen Laibow-Koser

The `as:` stuff looks great, but isn’t the `require` and `permit` technique something of a step backwards? Now you need to filter in every controller action, instead of once in the model. Or am I missing something?